1.  

   1.  

      1. Impact
         Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.

Other shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.

1.  

   1.  

      1. Patches
         Patched in shelljs 0.8.5

1.  

   1.  

      1. Workarounds
         Recommended action is to upgrade to 0.8.5.

1.  

   1.  

      1. References
         https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/

1.  

   1.  

      1. For more information
         If you have any questions or comments about this advisory:

• Ask at https://github.com/shelljs/shelljs/issues/1058

• Open an issue at https://github.com/shelljs/shelljs/issues/new

Repository: OpenNMS/newts (https://github.com/OpenNMS/newts)
Dependabot: https://github.com/OpenNMS/newts/security/dependabot/42
CVE:
CVSS:
GHSA: GHSA-64g7-mvw6-v9qj
Severity: medium
Ecosystem: npm
Package Name: shelljs
Vulnerable Version Range: < 0.8.5
First Patched Version: 0.8.5